Analysis

  • max time kernel
    1s
  • max time network
    163s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    22/08/2026, 04:32

General

  • Target
    天柱1.apk
  • Size 9.9MB
  • Sample260822-e53mja1ckg
  • SHA256 124f0b87fc73c58e2c87e3ff1b913500e5550b0871afdca11215822d4c75a040
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.skymobi.mopowydv1
    1⤵
    • Queries information about running processes on the device
    • Reads the content of SMS inbox messages.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks memory information
    PID:4309

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1.apk

        • Path /data/data/com.skymobi.mopowydv1/files/repo/com.skymobi.moposns.plugin.account/19/1.apk
        • Size 429KB
        • SHA256 c3e3aebc7258cb705e876b2541d2863f68dc3a0adf8e5a72e201e68880376d92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.skymobi.pay.tplugin_V3003.apk

        • Path /storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.tplugin_V3003.apk
        • Size 447KB
        • SHA256 e449ead95605a15be5c73e522e606dd8b2def15a594f4c0149ba72b4e799239b
        • MD5 SHA1 SHA512 SSDEEP TLSH